Add Content-Disposition header to file downloads

chris_backend/core/views.py

@@ -1,5 +1,6 @@
 
 import logging
+import uuid
 import jwt
 
 from django.contrib.auth.models import User
@@ -51,8 +52,8 @@ def perform_create(self, serializer):
         """
         user = self.request.user
         dt = timezone.now() + timezone.timedelta(minutes=10)
-        token = jwt.encode({'user': user.username, 'exp': dt}, settings.SECRET_KEY,
-                           algorithm='HS256')
+        token = jwt.encode({'user': user.username, 'nonce': str(uuid.uuid4()), 'exp': dt},
+                           settings.SECRET_KEY, algorithm='HS256')
         serializer.save(token=token, owner=user)
 
     def list(self, request, *args, **kwargs):

chris_backend/filebrowser/views.py

@@ -1,5 +1,6 @@
 
 import logging
+from pathlib import Path
 
 from django.http import Http404, FileResponse
 from django.shortcuts import get_object_or_404
@@ -492,7 +493,10 @@ def get(self, request, *args, **kwargs):
         Overriden to be able to make a GET request to an actual file resource.
         """
         chris_file = self.get_object()
-        return FileResponse(chris_file.fname)
+        f = chris_file.fname
+        resp = FileResponse(f)
+        resp['Content-Disposition'] = f'attachment; filename="{Path(f.name).name}"'
+        return resp
 
 
 class FileBrowserFileGroupPermissionList(generics.ListCreateAPIView):
@@ -820,7 +824,10 @@ def get(self, request, *args, **kwargs):
         Overriden to be able to make a GET request to an actual file resource.
         """
         chris_link_file = self.get_object()
-        return FileResponse(chris_link_file.fname)
+        f = chris_link_file.fname
+        resp = FileResponse(f)
+        resp['Content-Disposition'] = f'attachment; filename="{Path(f.name).name}"'
+        return resp
 
 
 class FileBrowserLinkFileGroupPermissionList(generics.ListCreateAPIView):

chris_backend/pacsfiles/views.py

@@ -1,4 +1,6 @@
 
+from pathlib import Path
+
 from django.http import FileResponse
 from django.contrib.auth.models import User, Group
 from django.shortcuts import get_object_or_404
@@ -463,4 +465,7 @@ def get(self, request, *args, **kwargs):
         Overriden to be able to make a GET request to an actual file resource.
         """
         pacs_file = self.get_object()
-        return FileResponse(pacs_file.fname)
+        f = pacs_file.fname
+        resp = FileResponse(f)
+        resp['Content-Disposition'] = f'attachment; filename="{Path(f.name).name}"'
+        return resp

chris_backend/pipelines/views.py

@@ -1,5 +1,6 @@
 
 import logging
+from pathlib import Path
 
 from django.http import FileResponse
 from django.contrib.auth.models import User
@@ -202,7 +203,10 @@ def get(self, request, *args, **kwargs):
         Overriden to be able to make a GET request to an actual file resource.
         """
         source_file = self.get_object()
-        return FileResponse(source_file.fname)
+        f = source_file.fname
+        resp = FileResponse(f)
+        resp['Content-Disposition'] = f'attachment; filename="{Path(f.name).name}"'
+        return resp
 
 
 class PipelinePluginList(generics.ListAPIView):

chris_backend/userfiles/views.py

@@ -1,4 +1,6 @@
 
+from pathlib import Path
+
 from django.http import FileResponse
 
 from rest_framework import generics, permissions
@@ -127,4 +129,7 @@ def get(self, request, *args, **kwargs):
         Overriden to be able to make a GET request to an actual file resource.
         """
         user_file = self.get_object()
-        return FileResponse(user_file.fname)
+        f = user_file.fname
+        resp = FileResponse(f)
+        resp['Content-Disposition'] = f'attachment; filename="{Path(f.name).name}"'
+        return resp